2222 FEDERAL BUREAU OF INVESTIGATION 
THE DIRECTOR'S ANNUAL AWARDS FOR EXCELLENCE 
Outstanding Cyber Investigation 


Nomination Мато: ЕЕЕ 


Nomination POC: Thomas Grasso 
AM Date: 02/13/2013 
_Nominee(s) 
Nominee: EDWARD ARIAS 
Agency: FBI HONOLULU. 
Work Address:- washington, DC 20535 


" Nominee: Ethan Arenson 
Agency: DOJ National Security Division 
Work Address: washington, DC 20535 


.. Nomines: MICHAEL POSTON - 
. Agency: FBI PHILADELPHIA 
. Work Address: washington, DC 20535 


" Nominee: NICHOLAS BLUDWORTH 
* Agency: FBI HONOLULU 
: Work Address: washington, DC 20535 


‘Nominee: STEPHEN GAUDIN 
Agency: FBI ABU DHABI 


Work Address: washington, ОС 20535 - 


Nominee: ROBERT SMITH 
Agency: FBI DALLAS - 


` Work Address: washington, DC 20535. 


Nominee: KACIE GALARZA 
- Agency: FBI HONOLULU 
Work Address: washington, DC 20535 


Nominee: JEFFREY: COLLINS 


No. 1:21-cr-00582-CRC (D.D.C.) 


Sponsoring Division: D16-CYBER DIVISION. 
POC Phone Number: 412-475-1875 
Gorl: Group ` 


_ Nominee Title: SPECIAL AGENT 
Series: 1811 Grade: 13 
Work Phone Number: 808-566-4300 . 


` Nominee Title: Trial Attorney 
Series: Grade: 
Work Phone Number: 202-305-9364 


Nominee Title: SPECIAL AGENT - 
Series: 1811. а Grade: 13 
Work Phone Number: 703-603-3967 


Nominee Title: SPECIAL AGENT 
Series: 1811 Grade; 12 
Work Phone Number: 808-673-7279 


Nominee Title: SUPVY SPECIAL AGENT 
Series: 1811 Grade: 15 
Work Phone Number: 01197124142688 


Nominee Title: SPECIAL AGENT 
Series: 1811 Grade: 13. 
Work Phone Number: 972-559-5537 · 


Nominee Title: INTELLIGENCE ANALYST 
Series: 0132 К Grade: 12 


- Work Phone Number: 808-673-7281 


Nominee Title: SPECIAL AGENT FBI DOJ CFH 011104 


SCO FBIPROD 010720 


SCO-021291 
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Agency: FBI HONOLULU 
Work Address: washington, DC 20535 


Nominee: Carol Sipperly 
Agency: DOJ National Security Division 
Work Address: washington, DC 20535 


Nominee: DARA K. SEWELL 
Agency: FBI DETAILS: OTD CO-OP 
Work Address: Washington, DC 20535 


Nominee: Rodney Joffe 
Agency: Neustar 
Work Address: Washington, DC 20535 


Nominee: Borut Stok 
Agency: Slovenia MU Police - 
Work Address: Washington, DC 00000 


Nominee: BINNEN 
Agency: ЖЕЕ 


- Work Address: Pittsburgh, PA 00000 


Nominee: НЕН 
Agency: 77 


Work Address: Washington, DC 00000 


Nominee: Drazen Visnjic 
Agency: Bosnia and Herzegovina RSMU Police 
Work Address: Washington, DC 00000 


No. 1:21-cr-00582-CRC (D.D.C.) 


Series: 1811 Grade: 12 
Work Phone Number: 808-673-7283 


` 


Nominee Title: Trial Attorney 
Series: Grade: 
Work Phone Number: 202-353-4253 


Nominee Title: SUPVY SPECIAL AGENT 
Series: 1811 Grade: 15 
Work Phone Number: 443-654-5628 


Nominee Title: Senior VP and Technologist 
Series: Grade: 
Work Phone Number: 602-418-6471 


Nominee Title: Chief 
Series: Ч Grade: 
Work Phone Number: +386 2 222 15 26 


Nominee Title: Director 
Series: . Grade: 


Work Phone Number: ЕЕЕ 


Nominee Title: НЕН 


Series: : Grade: 
Work Phone Number: 000-000-0000 


Nominee Title: Chief 
Series: Grade: 
Work Phone Number: 000-000-0000 
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DX-8 0002 
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Synopsis 


The team behind the [EE investigation broke new ground for Cyber Division with the most successful and 
largest botnet investigation to date. Tearri members used a combination of innovative techniques, liaison, and hard. 
* [work to apprehend the creator, operators and facilitators of some of the world's largest and most damaging botnets. - 
- [The Investigation developed strong relationships with International Law Enforcement partners and revealed new 
regions that are both a hotspots for cyber criminal activity and also very willing to join forces with the FBI. The 
investigation touched on subjects in 32. countries and resulted In 55 arrests/searches; With these actions came the 
dismantlement of many botnets including ШЕШЕЙ which infected an estimated 12 million computers; and another _ 
variant which infected an estimated 1.2 million computers. Prior to the extraordinary efforts of this team the e, 
malware has mo an estimated $997, 500, 000 damages worldwide. : 
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. Justification 


,m— investigation started in 2008 and has resulted in the successful apprehension of subjects in 
the United States, Bosnia, Serbia, Slovenia, Spain, the United Kingdom, and Vietnam. There have been 26 arrests in.6 
countries; 23 searches in 6 countries; 33 referrals to other countries and European Union Member States; апа 47 lIRs 
disseminated. Total losses as a result of | are estimated at $997,500,000 with impact to an estimated 13.3 million 
victims worldwide, The investigation has resulted in the dismantlement of numerous]. most notably the 
, estimated to be 12 million bots in size and another variant, estimated to be 1:2 million bots, 

Тһе great successes achieved by the team on the law enforcement side are only half the story behind the liic 
investigation. The case has become a vehicle through which Cyber Division has developed new and lasting 

. |relationships with valuable International partners. The international outreach efforts of the team have opened up the 
entire Balkan (South Eastern Europe) region for cooperation and have resulted in outstanding working relationships 
with Bosnia, Croatia, Serbia and Slovenia. The team also charted new territory for Cyber Division thought liaison and 
case coordination with Mexico, Peru and Argentina. These parts of South America along with the Balkan Peninsula 
were relatively untouched by our Cyber investigations. 

In terms of botnet cases the investigation is remarkable because it has successfully targeted all 3 tiers of a 
botnet: 1. Coders, 2. Users, and 3. Facilitators. The investigation started with an undercover operation initiated in 
Honolulu. 


. Team members purchased copies of I from on . 
. [three separate occasions and ultimately cultivated enough trust from ШЕ to be invited into ап elite underground > 
forum called Once the team had the | malware in hand they showed ingenuity by reaching out to 
trusted members of the security research community. It was through the extraordinary sharing efforts of team and 
"their ability to engage non-FBI partners in private sector and academia that they were able to link Iserdo to a massive 
botnet that appeared on the Internet and seemed to originate out of Spain. This botnet, which became known as 
turned out be one of the largest botnets ever encountered, infecting more than 12 million computers 
worldwide. Through continued outreach to private sector the team was able ta link private sector research into the 
botnet to an I customer known as At this point it became apparent that the massive 12 million 
bot botnet was in fact Iserdo's The investigation placed NetK in Spain and the team began the first of 
many successful International outreach efforts. At this point the team engaged the Spanish Guardia Civil and through . 
information sharing efforts and case coordination helped develop evidence to affect the arrest and searches of three 
subjects in Spain. One of the team members traveled to Spain to assist with the law enforcement action and as a result 
of the subsequent evidence sharing facts were uncovered to arrest an additional five subjects in Spain. An excellent 
working relationship was developed with the Spanish Guardia Civil which in turn resulted in evidence that implicated 
MATJAZ SKORJANC of Slovenia as the creator of ЕҢ With the MA Botnet dismantled and its operators 
neutralized, the team turned it efforts to building a case against the creator of| and working with.the Slovenian 
Police to apprehend him. One of the team members expended extraordinary efforts to convince the Slovenia Police to 
cooperate with the FBI on this matter. The level of cooperation ultimately achieved included FBI participating in the 
searches and arrests in Slovenia, along with complete access to SKORJANC and all evidence seized. Team members 
traveled to Slovenia and participated in the arrests, searches and interview of SKORJANC along with 4 of his co- 
conspirators. At this point the investigation had resulted in the apprehension of the creator М and all оГ his co- 
conspirators in Slovenia; the operators of the ЕЕ botnet and co-conspirators in Spain; and the dismantlement of 
the botnet. While these accomplishments were impressive the team did not rest on their laurels but instead 
conducted an exhaustive review of all evidence along with additional undercover work in order to spin-off new cases 
on other botnet operators. This ultimately resulted in the identification and referral of 141.subjects worldwide 
іп 32 countries.KORJANC was initially reluctant to cooperate with the FBI. However team members developed а 
prosecution strategy that effected his cooperation. The cooperation from SKORANC was significant and produced not 
only evidence on additional targets but also resulted in the FBI acquiring the backend database to the 
criminal forum. With this accomplished the FBI had all private and public messages; and user account information for 
one of the most serious criminal underground forums on the Internet.After SKORJANC's arrest and eventual 
cooperation, and with the ЕЕ database in hand, team members were able accomplish another significant ` 
milestone in the case: collaboration with Bosnia Police to arrest two subjects in Bosnia and takeover a boinet 1.2 
million computers In size, The collaboration and cooperation in Bosnia has lead to the Identification of many 
previously unknown cyber criminals in the region and the understanding that the Balkan region is a hotspot for cyber 
criminal activity; on par with Eastern Europe. The amount of activity uncovered by the team prompted the Botnet 
Threat Focus Cell to recommend the placement of a Cyber ALAT in Sarajevo along with the creation of a Balkan 
Regional Cyber Crime Task Force. Taking the evidence and intelligence gathered so far the team БӨК 90407 or | 
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g ) р р . 7 eng 
Europol asan effective way to disseminate leads and referrals to European Union Member States. In September of 
2011 a meeting was convened at Europol in The Hague. Present at the meeting were 12 EU member states. This . 
meeting resulted in'a framework for sharing intelligence and referring Izd case leads to EU member states. A total . 
of 7 referrals to 7 countries were made as a result of this meeting. Another significant development in the case was the: 
identification or 41 potential J customers in South America. This is a relatively new region on the Cyber front and 
in order to effect action on these targets team members traveled to Argentina, Mexico and Peru to brief regional police · 
on and share evidence. Three months after this outreach 6 subjects were searched in Peru. - 
` [In September of 2012, two years after the initial arrest of SKORJANC one of the team members, SA Collins, returned {о | 
Slovenia to testify in trial of-SKORJANC: The Slovenians have expressed gratitude for SA Collins’ testimony: The Cyber 
Division OGC who accompanied SA Collins commented that he testified for 8 hours during which he had excellent, 
demeanor and clearly knew the case well. The Slovenian Prosecutors could not be more pleased and were confident 
of a guilty verdict. The vast amount of evidence, intelligence and International cooperation achieved in this case 
cumulated this December with Operation Darkbot.. This international takedown of botnet subjects resulted in 9 
` Jarrests, 13 searches and 37 knock and talks in a total of 9 countries. From this takedown, 3 of.the arrests, 7 of the 

searches, and 32 of knock and talks were a direct result of the | investigation. | Р 5 
іп conclusion, the | investigation was a massive undertaking by team members that resulted in an unprecedented 
number of arrests and prosecutions for a botnet investigation. The team broke new ground іп terms of International 
outreach and opened up new regions of the world for cooperation on cyber investigations. The outcorne of the BFBot 
investigation will continue to benefit the FBI and Cyber Division for years to come. 
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| Wilson, Shaunta N. A. (HRD) (FBI) 


From: - | | ‚ WAYE, AMY.E (HRD)(FBI) 

© Sent > | . Tuesday, March 12, 2013 5:28 PM 
To: GRASSO, THOMAS (CYDY(FBI); BURNSIDE, JENNIFER (CYD)(FB)) 
Сс: >. - : HARVEY, SHAUNTA (HRD)(FBI); SMITH, SCOTT S: (HRD) (FBI) · 
Subject: | . RE: Rewrite or DA Nonination for Butterfly Bot --- UNCLASSIFIED | 
Follow Up Flag: Follow up 
Flag Status: > Completed: 


Classification: UNCLASSIFIED 


Amy 


Amy E. Waye, UC 
` HRD ARU/Communications 
(202) 324-3680 


From: GRASSO, THOMAS (CYD)(FBI) 
: Sent: Tuesday, March 12, 2013 4:19 PM 
“Тө: WAYE, АМҮ E (HRD)(FBI); BURNSIDE, JENNIFER (CYD)(FBI) 
Cc: HARVEY, SHAUNTA (HRD)(FBI); SMITH, SCOTT S. (HRD) (FBI) А 
Subject: RE: Rewrite or DA Nonination for Butterfly Bot --- UNCLASSIFIED ` ^ 


Classification: UNCLASSIFIED 


10-4, Working оп this now. 


From; WAYE, AMY E (НЕБУЕВТ) 
Sent: Tuesday, March 12, 2013 10:29 АМ . 
То: GRASSO, THOMAS (CYD)(FBI); BURNSIDE, JENNIFER (CYD)(FBI) 

` Cc; HARVEY, SHAUNTA (HRD)(FBI); SMITH, SCOTT S. (HRD) (FBI) 
Subject: RE: Rewrite or DA Nonination for Butterfly Bot --- UNCLASSIFIED 


Classification: UNCLASSIFIED 


We do still need some confirmation that the 2 from foreign LE agencies and the private sector are eligible to be 
- nominated from the agency's ás well as aware-of the nomination. - 


1 ` B 
FBI DOJ СЕН 011097 | 


SCO FBIPROD 010725 
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No. 1:21-cr-00582-CRC (D.D.C.) DX-8 0006 


The letter should come from head of agency, but | will accept the Chief Human Capital Officer. Please note that this 
serves as a "Name Check" for поп-ЕВІ employees. That is, the FBI requires confirmation that the person's home agency 
supports the nomination and confirms that there is nothing in their background that would prevent them from receiving 
the award (such.as an OPR for an FBI employee). 


Thank you, 
Amy 


Ату E. Waye, UC 
HRD ARU/Communications 
(202) 324-3680 


From: GRASSO, THOMAS (CYDY(FBI) 

Sent: Tuesday, March 12, 2013 9:10 AM 

To: BURNSIDE, JENNIFER (CYD)(FBI) 

Cc: WAYE, AMY E (HRD)(FBI) 

Subject: RE: Rewrite or DA Nonination for Butterfly Bot --- UNCLASSIFIED 


Classification: UNCLASSIFIED 


Hello Jennifer, 


Letters of concurrence have been uploaded for the DOJ team members. The other agencies would be 2 foreign LE 
agencies and 3 private sector companies. Since these are all outside of USG do we still need letters? If so, who would 
they come from, immediate supervisor, CEO, HR person? 


Thanks. 


--Tom 


From: BURNSIDE, JENNIFER (CYD)(FBI) 

Sent: Monday, March 11, 2013 7:05 PM 

To: GRASSO, THOMAS (CYDXFBI) 

Cc: WAYE, AMY E (HRD)(FBI) 

Subject: FW: Rewrite or DA Nonination for Butterfly Bot --- UNCLASSIFIED 


Classification: UNCLASSIFIED 


Tom, 

Please see Amy's message below to request external agency concurrence letters. 
From: WAYE, AMY E (HRD)(FBI) 

Sent: Monday, March 11, 2013 2:43 PM 


ЕВІ DOJ СЕН 011098 
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To: BURNSIDE, JENNIFER (CYD)(FBI) 
Cc: BOLES, JOHN (CYD) (FBI) ? 
Subject: RE: Rewrite or РА Nonination for Butterfly Bot --- UNCLASSIFIED 


Classification: UNCLASSIFIED 


Jenn: 
Just to clarify: ; pe. 
Only these names are actually added...the others were already named on the original nomination. 


Also, have the Letters of the Concurrence been requested from the outside agencies? 


Thank you, 


Amy | 2-4 
Dara Sewell | ; * m 
| Investigative Analysis Unit- | SSA ' | REDACTED 


First, 2 | Letter of 
Middle, |i e. . | Concurrence 
я (Yes or No) 


Senior VP 


and | 
Technologist 


Borut Stok | Slovenia MU | Chief ` ‘Maribor — 1526 
ІЗ ES ЗЕН 
| Drazen Bosnia and Banja Luka REDACTED 240 285. 

“Visnjic | Herzegovina Bosnia and | drazen.visnjic@mup.viadars.ne 


RSMU: f Herzegovin |, 
Police j a 


"Amy E. Waye, UC 
HRD ARU/Communications 
(202) 324-3680 


FBI DOJ CFH 011099 
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From: BURNSIDE, JENNIFER (CYD)(FBI) 

Sent: Saturday, March 09, 2013 3:30 PM 

To: WAYE, AMY. E (HRD)(FBI) 
“Сс: BOLES, JOHN (СҮР) (FBI) 

Subject: FW: Rewrite or DA Nonination for Butterfly Bot --- UNCLASSIFIED 


е 


Classification: UNCLASSIFIED 


' Below is the expanded list of names. 


. List of Nominees : (Bureau employees; add rows as needed) 


Fames [rie а 
ETC [m xD AC TED] 
Meermem [а | i 
ишо» а | 
кте m 
ыыы [ж | 
[^^ л т 
kekem — |^ | 

к= 


` | Dara Sewell 
Investigative Analysis Unit 


FBI DOJ CFH 011100 


SCO FBIPROD 010728 
SCO-021299 


No. 1:21-cr-00582-CRC (D.D.C.) DX-8 0009 


- List of Nominees: (Non-Bureau employees; add rows as needed) z 
' "| Agency i Seri i Phone/ e- | Letter of 


‚апа, if : sal à mail Concurrence 


,any, address | {Үез ог Мо) 
Division d 


Carol “DOJ, CCIPS | Trial Attorney GS-905-15 | Washington | 253 
Sipperly .' "| DG ' " | carol.sipperrly 


| Ethan | Dos, CCIPS | Trial mei GS-905- 15 | Washington : ' 

ч mt ethan.arenson 
Arenson DC Ё 

| @usdoj.gov 
= A 


PA 


Neustar Senior VP Washington 
.| and DC 
‚| Technologist 
-Borut Stok | Slovenia MU | Chi б Maribor ^ ' | БУДЫ») 15 
T "prem 77), m o Slovenia .: | 
; y “| borut:stok@pol 
: А қ y icija.si 
| Drazen | Bosniaand ^ | Chi Бала Luka | REDACTED J 
[Viajo | Herzegovina | Bosnia and |285 
| RSMU Police : Herzegovina | drazen.visnjic 
' @mup.viadars. 
net 
Jennifer S. Burnside 
Chief of Staff 
Cyber Division . 
Rm.5835 ; 
Phone: 202-324-8786 
Mobile: ШЕШ5-0492 


` From: GRASSO, THOMAS (CYD)(FBI) 
Sent: Friday, March 08, 2013 2:21 PM 


To: BOLES, JOHN (CYD) (FBI); BURNSIDE, JENNIFER (CYD)(FBD); TRAHON, PETER (CYDYFBI) 
Cc: STROM, ERIC (CYD)(FBI) 


Subject: Rewrite or DA Nonination for Butterfly Bot --- UNCLASSIFIED 


5 
FBI DOJ CFH 011101 
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No. 1:21-cr-00582-CRC (D.D.C.) DX-8 0010 


Classification: UNCLASSIFIED 


«« File: DA Nomination New.docx >> 


Justification now under 8,500 chras. You can disregard the previous version that | sent: 


Thanks. 


From: GRASSO, THOMAS (CYD)(FBI) 

Sent: Friday, March 08, 2013 1:07 PM : 

To: BOLES, JOHN (CYD) (FBI); BURNSIDE, JENNIFER (CYD)(FBI); TRAHON, PETER (CYDY(FBI) 
Се: STROM, ERIC (CYDX(FBI) i 

Subject: Rewrite or DA Nonination for Butterfly Bot --- UNCLASSIFIED 


Classification: UNCLASSIFIED . 


«« File: DA Nomination New.docx »» 
Hello, 


AD Demarrest requested that | expand the Butterfly Bot DA nomination to include private sector and non-CyD 
entities that assisted with the case. Attached is the expanded version that includes: OTD Investigative Analysis Unit, 
Bosnia Police, Slovenia Police, Neustar, Dell SecureWorks, and Defense Intelligence Company. .  . | І 


_ Its been a struggle for me to get this done in the few hours I’ve had to work on it so this version is likely over the - 
.8000 character limit. | wanted to get it to everyone so they have something to review. lam working now to trimit - 
down. The gist of it will be the same so please use this now as needed. : 


. Thanks. 
-Тот : 


Thomas X. Grasso, Jr. 2. 

Supervisory Special Agent 

Cyber Division 

Office: (412) 802-8000 x258 i 


Cell: g 1875 


Classification: UNCLASSIFIED 
FBI DOJ CFH 011102 


SCO FBIPROD 010730 
SCO-021301 
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Classification: UNCLASSIFIED 


No. 1:21-cr-00582-CRC (D.D.C.) 


FBI DOJ CFH 011103 


SCO FBIPROD 010731 
SCO-021302 


DX-8 0012 


Wilson, Shaunta N. A. (HRD) (FBI 


From:. oo г WAYE, AMY E (НАСЕВ). 
Sent © | О Thursday; March 21, 2013 4:43 PM 
To: І : HARVEY, SHAUNTA (HRD)(FBI) 


` Subject © — — — RE: Letters of Concurrence --- UNCLASSIFIED 
Classification: UNCLASSIFIED 


- The last letter of concurrence will be an email. 
| will forward to you on the low side. 
Thanks so much, . 
- Amy | 


Amy E. Waye, UC - 
: -HRD ARU/Communications 
' (202) 324-3680 


e 


© From: HARVEY, SHAUNTA (HRD)(FBI) 
." Sent: Thursday, March 21, 2013 4 31 PM 
To: WAYE, AMY E (HRDY(FBI) . 
| Subject: RE: Letters of Concurrence --- UNCLASSIFIED... 


aset tein: UNCLASSIFIED 


. Thank you. .| have added the contact information and letters of concurrence for Aaron Hackworth, Chris Davis, Borut. 
Stok, and Rodney I Joffe. 


> Oncel have recéived the final letter for Drazen Visnjic (Bosnia), І will add. his information i in EPAS as s well and be sure to 
. add the updated information to the Director's binder. 


Shaunta N. A. Harvey 
-Human Resources Specialist 

Human Resources Division - Awards & Recognition Unit . Dl o 200092. E 

FBI Headquarters, Room 10184 EE - . =o 
(202)324-0415 Direct | i | | 


From: WAYE, АМҮ E (HRD)(FBI) 
Sent: Thursday, March 21, 2013 3:09 PM. 

To: HARVEY, SHAUNTA (HRD)(FBI) : 

Subject: FW: Letters of Concurrence --- UNCLASSIFIED - 


FBI DOJ CFH 011092 


SCO FBIPROD 010732 
5СО-021303 


Мо. 1:21-cr-00582-CRC (D.D.C.) DX-8 0013 


Classification: UNCLASSIFIED 


Amy E. Waye, UC А 
HRD ARU/Communications ` 
(202) 324-3680 ы 


From: GRASSO, THOMAS (CYD)(FBI) 

Sent: Thursday, March 21, 2013 1:38 PM 

To: WAYE, AMY E (HRD)(FBI) 

Subject: RE: Letters of Concurrence --- UNCLASSIFIED 


Classification: UNCLASSIFIED 


<< File: FBI.Rodney.Joffe.pdf >> 

Hello Amy, 

Attached is the letter for Joffe. All we need is Bosnia. | 
Thanks. 


--Tom КА КЕ 


From: GRASSO, THOMAS (CYD)(FBI) 

Sent: Thursday, March 21, 2013 11:47 AM 

To: WAYE, АМҮ E (HRD)(FBI) 

Subject: RE: Letters of Concurrence --- UNCLASSIFIED 


Classification: UNCLASSIFIED 


<< File: Chris-Davis-LOR.pdf >> 
Here is Chris Davis. Waiting on Bosnia and Rodney Joffe. 
Thanks. 


--Тот 


From: GRASSO, THOMAS (CYD)(FBI) 
Sent: Thursday, March 21, 2013 7:54 AM 


FBI DOJ CFH 011093 


SCO_FBIPROD_010733 
SCO-021304 


No. 1:21-cr-00582-CRC (D.D.C.) DX-8 0014 


To: WAYE, AMY E (HRDYEBD - : | ` mE 
| Subject: RE: Letters of Concurrence --- UNCLASSIFIED TN 


Classification: UNCLASSIFIED 


v 


«« File: 2013-03-20 Aaron Hackworth FBI Directors Award Nomination.pdf >> 
. E 
Hello, | | | | | К 
Attached i is the letter for Aaron Hackworth. | 
. Working on Bosnia, Chris Davis, Rodney Joffe. - 
Thanks. 


—Tom. | 


From: GRASSO, THOMAS (CYDY(FBI) 

Sent: Wednesday, March 20, 2013 5:45 PM | 

To: WAYE, AMY E (HRDY(FBI) . | | ` 
“Сс: BURNSIDE, JENNIFER (CYD)(FBI); WILSON, TANYA (HRD) (FBI); HARVEY, , SHAUNTA (HRDYFBD | 
| Subject: RE: Letters of Concurrence --- UNCLASSIFIED E 


Classification: UNCLASSIFIED 


¿Hello Amy, >. m m BEEN o B | | Uv ZEN 


lam working with our Legats. on this and private sector partners on the others. Attached is what we received from | 
Slovenia. Still waiting on Bosnia, Neustar, SecureWorks, and Defenselntelligence. 


Thanks. 


--Tom 
«« File: Borut; Stok Letter. of Assent, Slovenia.doc >> 


From: WAYE, AMY E (HRD)(FBI) 
Sent: Tuesday, March 19, 2013:5:19 PM 
To: GRASSO, THOMAS (CYD)(FBI) 
Cc: BURNSIDE, JENNIFER (CYD)(FBI); WILSON, TANYA (HRD) (FBI); HARVEY, SHAUNTA (HRDXFBD | 
Subject: | Letters of Concurrence. --- UNCLASSIFIED 


Classification: UNCLASSIFIED 


FBI DOJ CFH 011094 


SCO_FBIPROD_010734 
SCO-021305 


No. 1:21-cr-00582-CRC (D.D.C.) DX-8 0015 


1 


Please let me know the status of the Letters of Concurrence for the additional nominees added to the Butterfly Bot 
nomination at your earliest convenience. 


ARU will send the approved nominations to the Director on Friday for his review and the Letters of Concurrence are 
included. 


Thank you, 
Amy 


Additional nominees who require a Letter of Concurrence: 


First, Agency and, Series/ City, State, | Phone/ e-mail address Letter of 
Middle, if any, Grade, if | Zip Concurrence 
Division | any (Yes or No) 


бк] і Pittsburgh 
PA 
Rodney | Neustar Senior VP Washington | ӘШБ 6471 
Joffe and DC rjoffe@centergate.com 
Technologist 
Borut Stok | Slovenia MU | Chief Maribor 15 26 
Police Slovenia borut stok@policija.si 


Drazen Bosnia and | Chief Banja Luka 285 
Visnjic Herzegovina Bosnia and 

RSMU ' Herzegovin 

Police | а 


drazen.visnjic(ümup.vladars.ne 


t 
Amy E. Waye, UC 
HRD Awards and Recognition Unit 
HRD Communications 
(202) 324-3680 (О) 
(202) 557-9652 (BB) 
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70.8. Departnient of Justice 


Criminal Division 


Computer Crime & Intellectual Property Section 

- 1301 New York Ave., Suite 600 ] E 
Washington, D.C. 20530 . | М 
РНОМЕ: (202) 514-1026 
FAX: (202) 514-6113 


February 8, 2013 
Thomas X. Grasso, Ji. 
Federal Bureau of Investigation 


Cyber Division 
thomas.grasso@ic.fbi.gov 
Dear Mr. Grasso: 
I understand that you wish to nominate the Butterfly Bot Investi gation for a Director's 
Award under the category of Outstanding Cyber Investigation. 1 am the prosecutor assigned to 


` this case and fully support your decision to nominate the investigation for an award.. 


If I can provide any additional information please do not hesitate to contact me. 


Ver truly yours, 


an Arenson . | 
ots Trial Attorney . 
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neustar 


March 21, 2013. 
. Via Email 
| Thomas X. Grasso | 
Supervisory Special Agent 
Cyber Division _ 


Federal Bureau of Investigation E 
m Thomas. Grasso@ic. fbi.gov 


Re: Nominations for FBI Director" 5 Award 
Dear Mr. Grasso: | 
I understand that you wish to include Neustar Fellow Rodney Joffe i in the slate of candidates you 
. are nominating for the FBI Director's Award for work done i in the "Butterfly Botnet" 
` investigation and prosecution. I fully support the overall nomination of the investigation and 


ED prosecution for an award and also the nomination of Mr. 1 offe for his hard work. 


I sincerely appreciate the FBI's willingness to recognize the work dorie by our employee i in 
collaboration with the FBI on this groundbreaking and important investigation. 


- Please let me know if you һауе апу questions or need any-additional information from me. 


t 


Sincerely, 


` Dr. Mark F. Bregnian 2 
CTO, Neustar Inc. 


 Neustar, Inc. / 401 Castro Street, Suite 300, Mountain View, CA 94041 USA / tel: 1.571. 434, 5400 / www.neustar.biz 
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. 2013 Director's Annual Awards for Excellence Recipients 


| EXCELLENCE IN LEADERSHIP EE Е 
Supervisory Special Agent Robert Bone, Counterintelligence Division 


EXCELLENCE IN INVESTIGATION | | 
'Special Agent.Bradlee Godshall, San Diego Field Office 


EXCELLENCE IN INVESTIGATIVE SUPPORT 
Supervisory Special Agent James Coleman, Operational Technology Division. 


OUTSTANDING COUNTERINTELLIGENCE INVESTIGATION | 
Bigger Game ` 
' Houston Field Office 


Special Agent Scott Leon Anderson, Department of Commerce |. 
Süpervisory Foreign Language Program Coordinator Val Bespaly, Houston . 
Administrative Specialist Sarah R. Dages, Houston Field Office 
Attorney Advisor Shana. М. Eaton, Department of Justice National Security Division . 
Intelligence Analyst Richard W. Garodnick, Houston Field Office БЕ 
Intelligence Analyst Katherina W. Gonzales, Counterintelligence Division .- 
Language Specialist Tetyana B. Hamilton, Houston Field Office > 
Supervisory Special Agent Darin S. Hanson, Houston Field Office 
Intelligence Analyst Debra Ann Hanson, Houston Field Office. --: . 
Assistant U.S. Attorney Hilàry Ley Jager, U.S. Attorney's Office, Eastern District of New York 
Supervisory Special Agent Kenneth W. James, Counterintelligence Division 
Intelligence Analyst Kate E. Koren, Office of Naval Intelligence, Farragut Technical Analysis Center 
Staff Operations Specialist Christina: Marie. Martinez, Houston Field Office . 
Supervisory Special Agent Eliza M. Odom, New York City Field Office 
- Special Agent Brady Jay Olson, Houston Field Office — , 
Special Agent Nathan T.T. Parker, Houston Field Office 
-Special Agent Lisa M. Parnpichate, Houston Field Office 
Special Agent Roman Rozhavsky, Houston Field Office 
: Assistant U.S. Attorney Daniel Silver, U.S. Attorney's Office, Eastern District of New York 


OUTSTANDING COUNTERTERRORISM. INVESTIGATION | 
Alwan Hammadi . 
Louisville Field Office - 


Supervisory Special Agent Timothy Beam, Louisville Field Office ` eo | Й E 
Intelligence Analyst Elizabeth L. Bowditch, Counterterrorism Division | | | | 


Special Agent Keith A. Carpenter, Louisville Field Office 
Special Agent Edward P. Cundiff, Louisville Field Office | 
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Special Agent Christopher Michael Faber, Louisville Field Office 
Unit Chief Michael Fowler (retired), Counterterrorism Division 
Special Agent Richard E. Glenn, Louisville Field Office 
Supervisory Special Agent Martin E. Hellmer, Phoenix Field Office 
Supervisory Special Agent James N. Hendricks, Little Rock Field Office 
Special Agent Kacy A. Jones, Louisville Field Office 
Intelligence Analyst Eric S. Kruer, Louisville Field Office 
Supervisory Intelligence Analyst Michael V. Matson, Louisville Field Office 
Intelligence Analyst Laura M. Stump, Louisville Field Office 

` Intelligence Analyst Cheyann. Nicole Videon, Counterterrorism Division 
Supervisory Special Agent Donald A. Wood, Columbia Division 


OUTSTANDING CYBER INVESTIGATION 
-ButterFly Bot Investigation 
Cyber Division 


Trial Attorney Ethan Arenson, U.S. Department of Justice, National Security Division 

Special Agent Edward Arias, Honolulu Field Office 

Special Agent Nicholas F. Bludworth, Honolulu Field Office 

Special Agent Jeffrey Michael Collins, Honolulu Field Office 

Director Chris Davis, Defense Intelligence Agency 

Intelligence Analyst Kacie K. Galarza, Honolulu Field Office 

Supervisory Special Agent Stephen J. Gaudin, International Operations Division 

Director Aaron Hackworth, Dell Secureworks 

Senior Vice President Rodney Joffe, Neustar 

Special Agent Michael C. Poston, Philadelphia Field Office 

Supervisory Special Agent Dara K. Sewell, Operational Technology Division 

Trial Attorney Carol Sipperly, U.S. Department of Justice, National Security Division 
Chief Borut Stok; Slovenia MU Police (Slovenia Ministry of Interior Police) i | 
Special Agent Robert Smith, Dallas Field Office 

Chief Drazen Visnjic, Bosnia and Herzegovina RSMU Police 


OUTSTANDING CRIMINAL INVESTIGATION 
Deepwater Horizon 
New Orleans Field Office 


Attorney Colin L. Black, U.S. Department of Justice, Criminal Division 
Special Agent Kelly C. Bryson, New Orleans Field Office 
Deputy Assistant Attorney General John Buretta, U.S. Department of Justice, Criminal Division 
Attorney Derek Cohen, U.S. Department of Justice, Criminal Division 
Attorney Scott Cullen, U.S. Department of Justice, Criminal Division 
Special Agent Amy J. Ford, New Orleans Field Office 
` Special Agent Michael Forrester, New Orleans Field Office 
Attorney Avi Gesser, U.S. Department of Justice, Criminal Division — . 
Intelligence Analyst Darrell W. Hill, New Orleans Field Office 
Special Agent Barbara O'Donnell (retired), New Orleans Field Office : 
. Assistant U.S. Attorney Richard Pickens, U.S. Attorney's Office, Eastern District of Louisiana 
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Special Agent J. R. Smith, New Orleans Field Office ' 

Attorney Rohan Virginkar; U.S. Department of Justice, Criminal Division 
Special Agent Jeffrey T. Wright, New Orleans Field Office 

Supervisory Special Agent Sandra M. Zulli, New Orleans Field Office 


OUTSTANDING SERVICE BY A FEDERAL WAGE GRADE SYSTEM EMPLOYEE 
Maintenance Mechanic Supervisor Anthony Thomas Naumoff, Facilities and Logistics Services Division 


EXCELLENCE IN PROGRAM MANAGEIVIENT 
Asset Management System Team 
Finance Division 


Supervisory Management and Program Analyst David W. Alwine, Finance Division 
Management and Program Analyst Lisa Curry, Information Technology Branch 
Management and Program Analyst Adam Dumey, Resource Planning Office 
Supervisory Operating Accountant Andrew S. Gregory, Finance Division 

Management and Program Analyst Michael G. Miguel, Finance Division 

Accountant Erica L. Nacca, Finance Division 

Accountant Jill Petroski, Finance Division 

Computer Scientist Richard D. Scherer, Information Technology Management Division 


DISTINGUISHED SERVICE BY A NEW EMPLOYEE 
Special Agent Samuel Benson, Anchorage Field Office 


DISTINGUISHED SERVICE BY A PROFESSIONAL STAFF EMPLOYEE 
Physical Scientist Melissa R. Gische, Laboratory Division 


SUSTAINED DISTINGUISHED SERVICE 
Intelligence Analyst Donna M. Maurer, Washington Field Office 


EQUAL EMPLOYMENT OPPORTUNITY 
Intelligence Analyst Hannah Bradley Gray, Richmond Field Office 


EXCELLENCE IN INTELLIGENCE ANALYSIS | 
Intelligence Analyst Nicholas C. Carlsen, Counterintelligence Division 


EXCELLENCE IN THE HUMINT PROGRAM 
Helms Sikkenga 
Minneapolis Field Office 


Special Agent Drew Helms, Minneapolis Field Office 
Intelligence Analyst Steve R. Sikkenga, Minneapolis Field Office 
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OUTSTANDING SERVICE TO DISABLED EMPLOYEES OR BY A DISABLED EMPLOYEE 
Supervisory Information Technology Specialist Barbara Bowling, Information Technology Services 
Division 


EXCEPTIONAL PUBLIC SERVICE 
Environmental Protection Specialist Catherine Alexandra Shaw, Facilities and Logistics Services Division 


OUTSTANDING SCIENTIFIC ADVANCEMENT 
: Black Box Study Team 
Criminal Justice Information Services Division 


Research Chemiíst Dr. JoAnn Buscaglia, Laboratory Division 
Management and Program Analyst Joey L. Newell, Criminal Justice Information Services Division . 
Physical Scientist Maria Antonia Roberts, Laboratory Division 


OUTSTANDING INFORMATION MANAGEMENT 
RISC Technical Team 
Criminal Justice Information Services Division 


Information Technology Specialist Micheal A. Carpenter, Criminal Justice Information Services Division 
Information Technology Specialist Jason T. Dale, Criminal Justice Information Services Division 
Mariagément and Program Analyst Nellie Ann Davis, Criminal Justice Information Services Division 
Supervisory Information Technology Specialist Matthew B. Fancher, Criminal Justice Information 
Services Division 
Information Technology Specialist Brendan Patrick Forst, Criminal Justice Information Services Division 
Supervisory Information Technology Specialist Danny L. Genovese, Criminal Justice Information Services 
Division 
information Technology Specialist Delbert Faron Hall, Criminal Justice Information Services Division 
Information Technology Specialist Dell Higgins, Criminal Justice Information Services Division 
Information Technology Specialist Penny Lee Hines, Criminal Justice Information Services Division 
Supervisory Information Technology Specialist Faye L. Isabella, Criminal Justice Information Services 
Division : 
Management and Program Analyst Melissa B. Maxwell, Criminal Justice Information Services Division 
Supervisory Information Technology Specialist James O. Preaskorn, Criminal Justice Information Services 
Division 
Information Technology Specialist Douglas Doyle Shaver, Criminal Justice Information Services Division 
Information Technology Specialist Denise A. Tenney, Criminal Justice Information Services Division 


OUTSTANDING TECHNICAL ADVANCEMENT 
ELSUR Data Application Development and Implementation Team 
Operational Technology Division 


Management and Program Analyst Laura Malia Cravalho, Operational Technology Division 
Electronic Surveillance Program Specialist Tana H. Estes, Operational Technology Division 
Supervisory Special Agent Thomas L. Kapp, Operational Technology Division 

Electronic Surveillance Program Specialist Don Kees, Operational Technology Division 
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Electronics Engineer Mia Latrisha Logan, Operational Technology Division 
Supervisory Management and Program Analyst. Alexa ndria M. Macpherson, “Operational Technology 
Division : 
| . Electronics Engineer Dusty M. McKinnon, Operational Technology Division 
с | Electronic Surveillance Program Specialist Carmen Y. Travis, Operational Technology Division 
DISTINGUISHED SERVICE TO THE LAW ENFORCEMENT COMMUNITY 
International Contract Corruption Task Force 
| Criminal Investigative Division 


- 57 Special Agent Steven P. Carter, Honolulu Field Office. 

. Supervisory Special Agent Robin Gazawi, Criminal Investigative Division 
Supervisory Special Agent Kyung Jin Kim, New York City Field Office 

- Supervisory Special Agent George M. Lopez, Los Angeles Field Office 
Supervisory Special Agent Kathleen M. Magnafici, Albuquerque Field Office 

` Supervisory Special Agent Eli S. Miranda, San Antonio Field Office 

Supervisory Special Agent Andrew Sekela, Tampa Field Office 
Special Agent Lee J. Witkowski, Sacramento Field Office 
Supervisory Special Agent Kevin M. Wolf, Washington Field Office 


` EXCELLENCE IN SUPPORT OF THE INTEGRITY AND COMPLIANCE PROGRAM 
CTD Compliance Program | | | | 
Counterterrorism Division. — . D i . . ' 


Management and Program Analyst S.J. Craig, Counterterrorism Division 
Management and Program Analyst Kirtlin W. Doyle, Counterterrorism Division 
Management and Program Analyst Daniel Fass, Counterterrorism Division 
: "Supervisory Management and Program Analyst James C. Lantz, Jr., Counterterrorism Division 
Management and Program Assistant Keisha Lee, Counterterrorism Division 
. Supervisory Management and Program Analyst Laresia A. Thompson, Counterterrorism Division 


DISTINGUISHED SERVICE. FOR ASSISTING VICTIMS OF CRIME 
Sandy Hook Elementary School Shooting 
‘New Haven Field Office . 


Forensic Child interview. Specialist Martha J. Finnegan, Office for Victim Assistance 
_ Victim Specialist Karen P. Gale, Omaha Field Office 
Victim Assistance Program ‘Specialist Kathleen Dee Hall, Office for Victim Assistance 
Victim Specialist Ashley Lauren Hall, New Haven Field Office 
. Victim Specialist Angela Jackson, New York City Field Office 
Victim Specialist Courtney C. Litowitz, Boston Field Office 
‘Victim Specialist Jennifer Jo Meyers, C Cleveland Field Office 
` Victim Specialist Renee Gail Murrell, Baltimore Field Office 
Forensic Disaster Assistance Specialist Kyle C. Scherrer, Office for Victim Assistance 
Victim Specialist Michele L. Stewart, Salt Lake City Field Office. | 
‘Victim Specialist Sarah Lynne Vasquez, Phoenix Field Office ' 
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IHE THOMAS E. DUHADWAY HUMANITARIAN AWARD 
intelligence Analyst Doris J. McKendall, New Orleans Field Office 


THE MANUEL J. GONZALEZ ETHICS AWARD 
Supervisory Special Agent Jeremy B. Walker, Human Resources Division 
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